This module matches certain packets in P2P flows. It is not designed to match all packets belonging to a P2P connection — use IPP2P together with CONNMARK for this purpose.

Use it together with -p tcp or -p udp to search these protocols only or without -p switch to search packets of both protocols.

IPP2P provides the following options, of which one or more may be specified on the command line:

--edk
    Matches as many eDonkey/eMule packets as possible.

--kazaa
    Matches as many KaZaA packets as possible.

--gnu
    Matches as many Gnutella packets as possible.

--dc
    Matches as many Direct Connect packets as possible.

--bit
    Matches BitTorrent packets.

--apple
    Matches AppleJuice packets.

--soul
    Matches some SoulSeek packets. Considered as beta, use careful!

--winmx
    Matches some WinMX packets. Considered as beta, use careful!

--ares
    Matches Ares and AresLite packets. Use together with -j DROP only.

--debug
    Prints some information about each hit into kernel logfile. May produce huge logfiles so beware!

Note that ipp2p may not (and often, does not) identify all packets that are exchanged as a result of running filesharing programs.

There is more information on http://ipp2p.org/ , but it has not been updated since September 2006, and the syntax there is different from the ipp2p.c provided in Xtables-addons; most importantly, the --ipp2p flag was removed due to its ambiguity to match "all known" protocols.